Giter VIP home page Giter VIP logo

messaging-aws-sqs-dynamodb-php's Introduction

vonage/messaging-aws-sqs-dynamodb-php

AWS Lambda function created in PHP that once triggered, moves a message from SQS into DynamoDB.

Prerequisites

Setup Instructions

Clone this repo from GitHub, and navigate into the newly created directory to proceed.

Use Composer to install dependencies

This example requires the use of Composer to install dependencies and set up the autoloader.

Assuming a Composer global installation. https://getcomposer.org/doc/00-intro.md#globally

composer install

AWS Setup

You will need to create AWS credentials as indicated by Serverless.

Also, create a new SQS queue using the default settings. Make note of the ARN for later use.

Lastly, create a new DynamoDB table using the default settings. Make note of the table name and ARN for later use.

Note: Ensure the primary key field name you set for the DynamoDB table matches the message ID in your SQS queue items. For this example we used messageId.

Update Environment

Rename the provided config.yml.dist file to config.yml and update the values as needed from AWS and DynamoDB, then save.

AWS_REGION: us-east-1
AWS_VERSION: latest
AWS_DYNAMODB_TABLE_NAME:
AWS_SQS_ARN:
AWS_DYNAMODB_TABLE_ARN:

Deploy to Lambda

With all the above updated successfully, you can now use Serverless to deploy the app to AWS Lambda.

serverless deploy

Invoke

If there are already messages in SQS, you can test the migration of these from SQS to DynamoDB by invoking the function by using Serverless locally:

serverless invoke -f sqstodynamo

Note: Above shows the use of function name sqstodynamo as specified in the default serverless.yml in this example.

For testing, you can add messages to SQS through the AWS Console website, or you can look at this repo for an example of how to add SQS messages through a typical HTTP POST request containing JSON.

Automate

To automate the usage of this function, you can add the newly created Lambda as a Lambda Trigger for your SQS instance.

By adding the trigger, it ensures that any new SQS messages call the Lambda function to automatically move the message to DynamoDB, therefore, removing the message from SQS.

Contributing

We love questions, comments, issues - and especially pull requests. Either open an issue to talk to us, or reach us on twitter: https://twitter.com/VonageDev.

messaging-aws-sqs-dynamodb-php's People

Contributors

adamculp avatar

Stargazers

avatar avatar

Watchers

avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar

Forkers

adamculp

messaging-aws-sqs-dynamodb-php's Issues

bref/bref-0.5.25: 9 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - bref/bref-0.5.25

Bref is a framework to write and deploy serverless PHP applications on AWS Lambda.

Library home page: https://api.github.com/repos/brefphp/bref/zipball/a153faeacd1ee4e31fb5465e80286ab32eef813e

Found in HEAD commit: a98b02cc6219479db20e92032a8c3cb68016cfdb

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (bref/bref version) Remediation Possible**
CVE-2024-24754 Critical 9.8 bref/bref-0.5.25 Direct 2.1.13 ❌
CVE-2020-15094 High 8.8 symfony/http-client-v5.1.0 Transitive N/A* ❌
CVE-2022-29248 High 8.1 guzzlehttp/guzzle-6.5.4 Transitive N/A* ❌
CVE-2022-31091 High 7.7 guzzlehttp/guzzle-6.5.4 Transitive N/A* ❌
CVE-2022-31090 High 7.7 guzzlehttp/guzzle-6.5.4 Transitive N/A* ❌
CVE-2022-31043 High 7.5 guzzlehttp/guzzle-6.5.4 Transitive N/A* ❌
CVE-2022-31042 High 7.5 guzzlehttp/guzzle-6.5.4 Transitive N/A* ❌
CVE-2024-24753 Medium 6.5 bref/bref-0.5.25 Direct 2.1.13 ❌
CVE-2024-24752 Medium 6.5 bref/bref-0.5.25 Direct 2.1.13 ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-24754

Vulnerable Library - bref/bref-0.5.25

Bref is a framework to write and deploy serverless PHP applications on AWS Lambda.

Library home page: https://api.github.com/repos/brefphp/bref/zipball/a153faeacd1ee4e31fb5465e80286ab32eef813e

Dependency Hierarchy:

  • ❌ bref/bref-0.5.25 (Vulnerable Library)

Found in HEAD commit: a98b02cc6219479db20e92032a8c3cb68016cfdb

Found in base branch: main

Vulnerability Details

Bref enable serverless PHP on AWS Lambda. When Bref is used with the Event-Driven Function runtime and the handler is a RequestHandlerInterface, then the Lambda event is converted to a PSR7 object. During the conversion process, if the request is a MultiPart, each part is parsed and its content added in the $files or $parsedBody arrays. The conversion process produces a different output compared to the one of plain PHP when keys ending with and open square bracket ([) are used. Based on the application logic the difference in the body parsing might lead to vulnerabilities and/or undefined behaviors. This vulnerability is patched in 2.1.13.

Publish Date: 2024-02-01

URL: CVE-2024-24754

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-82vx-mm6r-gg8w

Release Date: 2024-02-01

Fix Resolution: 2.1.13

CVE-2020-15094

Vulnerable Library - symfony/http-client-v5.1.0

Symfony HttpClient component

Library home page: https://api.github.com/repos/symfony/http-client/zipball/63342eabdc6fc6c12e6b18506a207d16687aa33f

Dependency Hierarchy:

  • bref/bref-0.5.25 (Root Library)
    • async-aws/lambda-0.5.0
      • async-aws/core-1.2.0
        • ❌ symfony/http-client-v5.1.0 (Vulnerable Library)

Found in HEAD commit: a98b02cc6219479db20e92032a8c3cb68016cfdb

Found in base branch: main

Vulnerability Details

In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests. HttpCache uses internal headers like X-Body-Eval and X-Body-File to control the restoration of cached responses. The class was initially written with surrogate caching and ESI support in mind (all HTTP calls come from a trusted backend in that scenario). But when used by CachingHttpClient and if an attacker can control the response for a request being made by the CachingHttpClient, remote code execution is possible. This has been fixed in versions 4.4.13 and 5.1.5.

Publish Date: 2020-09-02

URL: CVE-2020-15094

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-754h-5r27-7x3r

Release Date: 2020-09-02

Fix Resolution: 4.4.13,5.1.5

CVE-2022-29248

Vulnerable Library - guzzlehttp/guzzle-6.5.4

Guzzle is a PHP HTTP client library

Library home page: https://api.github.com/repos/guzzle/guzzle/zipball/a4a1b6930528a8f7ee03518e6442ec7a44155d9d

Dependency Hierarchy:

  • bref/bref-0.5.25 (Root Library)
    • ❌ guzzlehttp/guzzle-6.5.4 (Vulnerable Library)

Found in HEAD commit: a98b02cc6219479db20e92032a8c3cb68016cfdb

Found in base branch: main

Vulnerability Details

Guzzle is a PHP HTTP client. Guzzle prior to versions 6.5.6 and 7.4.3 contains a vulnerability with the cookie middleware. The vulnerability is that it is not checked if the cookie domain equals the domain of the server which sets the cookie via the Set-Cookie header, allowing a malicious server to set cookies for unrelated domains. The cookie middleware is disabled by default, so most library consumers will not be affected by this issue. Only those who manually add the cookie middleware to the handler stack or construct the client with ['cookies' => true] are affected. Moreover, those who do not use the same Guzzle client to call multiple domains and have disabled redirect forwarding are not affected by this vulnerability. Guzzle versions 6.5.6 and 7.4.3 contain a patch for this issue. As a workaround, turn off the cookie middleware.

Publish Date: 2022-05-25

URL: CVE-2022-29248

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29248

Release Date: 2022-05-25

Fix Resolution: guzzlehttp/guzzle - 6.5.6,guzzlehttp/guzzle - 7.4.3

CVE-2022-31091

Vulnerable Library - guzzlehttp/guzzle-6.5.4

Guzzle is a PHP HTTP client library

Library home page: https://api.github.com/repos/guzzle/guzzle/zipball/a4a1b6930528a8f7ee03518e6442ec7a44155d9d

Dependency Hierarchy:

  • bref/bref-0.5.25 (Root Library)
    • ❌ guzzlehttp/guzzle-6.5.4 (Vulnerable Library)

Found in HEAD commit: a98b02cc6219479db20e92032a8c3cb68016cfdb

Found in base branch: main

Vulnerability Details

Guzzle, an extensible PHP HTTP client. Authorization and Cookie headers on requests are sensitive information. In affected versions on making a request which responds with a redirect to a URI with a different port, if we choose to follow it, we should remove the Authorization and Cookie headers from the request, before containing. Previously, we would only consider a change in host or scheme. Affected Guzzle 7 users should upgrade to Guzzle 7.4.5 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.8 or 7.4.5. Note that a partial fix was implemented in Guzzle 7.4.2, where a change in host would trigger removal of the curl-added Authorization header, however this earlier fix did not cover change in scheme or change in port. An alternative approach would be to use your own redirect middleware, rather than ours, if you are unable to upgrade. If you do not require or expect redirects to be followed, one should simply disable redirects all together.

Publish Date: 2022-06-27

URL: CVE-2022-31091

CVSS 3 Score Details (7.7)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31091

Release Date: 2022-06-27

Fix Resolution: 6.5.8,7.4.5

CVE-2022-31090

Vulnerable Library - guzzlehttp/guzzle-6.5.4

Guzzle is a PHP HTTP client library

Library home page: https://api.github.com/repos/guzzle/guzzle/zipball/a4a1b6930528a8f7ee03518e6442ec7a44155d9d

Dependency Hierarchy:

  • bref/bref-0.5.25 (Root Library)
    • ❌ guzzlehttp/guzzle-6.5.4 (Vulnerable Library)

Found in HEAD commit: a98b02cc6219479db20e92032a8c3cb68016cfdb

Found in base branch: main

Vulnerability Details

Guzzle, an extensible PHP HTTP client. Authorization headers on requests are sensitive information. In affected versions when using our Curl handler, it is possible to use the CURLOPT_HTTPAUTH option to specify an Authorization header. On making a request which responds with a redirect to a URI with a different origin (change in host, scheme or port), if we choose to follow it, we should remove the CURLOPT_HTTPAUTH option before continuing, stopping curl from appending the Authorization header to the new request. Affected Guzzle 7 users should upgrade to Guzzle 7.4.5 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.8 or 7.4.5. Note that a partial fix was implemented in Guzzle 7.4.2, where a change in host would trigger removal of the curl-added Authorization header, however this earlier fix did not cover change in scheme or change in port. If you do not require or expect redirects to be followed, one should simply disable redirects all together. Alternatively, one can specify to use the Guzzle steam handler backend, rather than curl.

Publish Date: 2022-06-27

URL: CVE-2022-31090

CVSS 3 Score Details (7.7)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-25mq-v84q-4j7r

Release Date: 2022-05-19

Fix Resolution: 6.5.8,7.4.5

CVE-2022-31043

Vulnerable Library - guzzlehttp/guzzle-6.5.4

Guzzle is a PHP HTTP client library

Library home page: https://api.github.com/repos/guzzle/guzzle/zipball/a4a1b6930528a8f7ee03518e6442ec7a44155d9d

Dependency Hierarchy:

  • bref/bref-0.5.25 (Root Library)
    • ❌ guzzlehttp/guzzle-6.5.4 (Vulnerable Library)

Found in HEAD commit: a98b02cc6219479db20e92032a8c3cb68016cfdb

Found in base branch: main

Vulnerability Details

Guzzle is an open source PHP HTTP client. In affected versions Authorization headers on requests are sensitive information. On making a request using the https scheme to a server which responds with a redirect to a URI with the http scheme, we should not forward the Authorization header on. This is much the same as to how we don't forward on the header if the host changes. Prior to this fix, https to http downgrades did not result in the Authorization header being removed, only changes to the host. Affected Guzzle 7 users should upgrade to Guzzle 7.4.4 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.7 or 7.4.4. Users unable to upgrade may consider an alternative approach which would be to use their own redirect middleware. Alternately users may simply disable redirects all together if redirects are not expected or required.

Publish Date: 2022-06-10

URL: CVE-2022-31043

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-w248-ffj2-4v5q

Release Date: 2022-06-10

Fix Resolution: 6.5.7,7.4.4

CVE-2022-31042

Vulnerable Library - guzzlehttp/guzzle-6.5.4

Guzzle is a PHP HTTP client library

Library home page: https://api.github.com/repos/guzzle/guzzle/zipball/a4a1b6930528a8f7ee03518e6442ec7a44155d9d

Dependency Hierarchy:

  • bref/bref-0.5.25 (Root Library)
    • ❌ guzzlehttp/guzzle-6.5.4 (Vulnerable Library)

Found in HEAD commit: a98b02cc6219479db20e92032a8c3cb68016cfdb

Found in base branch: main

Vulnerability Details

Guzzle is an open source PHP HTTP client. In affected versions the Cookie headers on requests are sensitive information. On making a request using the https scheme to a server which responds with a redirect to a URI with the http scheme, or on making a request to a server which responds with a redirect to a a URI to a different host, we should not forward the Cookie header on. Prior to this fix, only cookies that were managed by our cookie middleware would be safely removed, and any Cookie header manually added to the initial request would not be stripped. We now always strip it, and allow the cookie middleware to re-add any cookies that it deems should be there. Affected Guzzle 7 users should upgrade to Guzzle 7.4.4 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.7 or 7.4.4. Users unable to upgrade may consider an alternative approach to use your own redirect middleware, rather than ours. If you do not require or expect redirects to be followed, one should simply disable redirects all together.

Publish Date: 2022-06-10

URL: CVE-2022-31042

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-f2wf-25xc-69c9

Release Date: 2022-06-10

Fix Resolution: 6.5.7,7.4.4

CVE-2024-24753

Vulnerable Library - bref/bref-0.5.25

Bref is a framework to write and deploy serverless PHP applications on AWS Lambda.

Library home page: https://api.github.com/repos/brefphp/bref/zipball/a153faeacd1ee4e31fb5465e80286ab32eef813e

Dependency Hierarchy:

  • ❌ bref/bref-0.5.25 (Vulnerable Library)

Found in HEAD commit: a98b02cc6219479db20e92032a8c3cb68016cfdb

Found in base branch: main

Vulnerability Details

Bref enable serverless PHP on AWS Lambda. When Bref is used in combination with an API Gateway with the v2 format, it does not handle multiple values headers. If PHP generates a response with two headers having the same key but different values only the latest one is kept. If an application relies on multiple headers with the same key being set for security reasons, then Bref would lower the application security. For example, if an application sets multiple Content-Security-Policy headers, then Bref would just reflect the latest one. This vulnerability is patched in 2.1.13.

Publish Date: 2024-02-01

URL: CVE-2024-24753

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-99f9-gv72-fw9r

Release Date: 2024-02-01

Fix Resolution: 2.1.13

CVE-2024-24752

Vulnerable Library - bref/bref-0.5.25

Bref is a framework to write and deploy serverless PHP applications on AWS Lambda.

Library home page: https://api.github.com/repos/brefphp/bref/zipball/a153faeacd1ee4e31fb5465e80286ab32eef813e

Dependency Hierarchy:

  • ❌ bref/bref-0.5.25 (Vulnerable Library)

Found in HEAD commit: a98b02cc6219479db20e92032a8c3cb68016cfdb

Found in base branch: main

Vulnerability Details

Bref enable serverless PHP on AWS Lambda. When Bref is used with the Event-Driven Function runtime and the handler is a RequestHandlerInterface, then the Lambda event is converted to a PSR7 object. During the conversion process, if the request is a MultiPart, each part is parsed and for each which contains a file, it is extracted and saved in /tmp with a random filename starting with bref_upload_. The flow mimics what plain PHP does but it does not delete the temporary files when the request has been processed. An attacker could fill the Lambda instance disk by performing multiple MultiPart requests containing files. This vulnerability is patched in 2.1.13.

Publish Date: 2024-02-01

URL: CVE-2024-24752

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-x4hh-frx8-98r5

Release Date: 2024-02-01

Fix Resolution: 2.1.13

symfony/yaml-v5.1.0: 1 vulnerabilities (highest severity is: 8.8) - autoclosed

Vulnerable Library - symfony/yaml-v5.1.0

Found in HEAD commit: a98b02cc6219479db20e92032a8c3cb68016cfdb

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in Remediation Available
CVE-2020-15094 High 8.8 symfony/http-client-v5.1.0 Transitive N/A ❌

Details

CVE-2020-15094

Vulnerable Library - symfony/http-client-v5.1.0

Symfony HttpClient component

Library home page: https://api.github.com/repos/symfony/http-client/zipball/63342eabdc6fc6c12e6b18506a207d16687aa33f

Dependency Hierarchy:

  • symfony/yaml-v5.1.0 (Root Library)
    • symfony/console-v5.1.0
      • symfony/string-v5.1.0
        • ❌ symfony/http-client-v5.1.0 (Vulnerable Library)

Found in HEAD commit: a98b02cc6219479db20e92032a8c3cb68016cfdb

Found in base branch: main

Vulnerability Details

In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests. HttpCache uses internal headers like X-Body-Eval and X-Body-File to control the restoration of cached responses. The class was initially written with surrogate caching and ESI support in mind (all HTTP calls come from a trusted backend in that scenario). But when used by CachingHttpClient and if an attacker can control the response for a request being made by the CachingHttpClient, remote code execution is possible. This has been fixed in versions 4.4.13 and 5.1.5.

Publish Date: 2020-09-02

URL: CVE-2020-15094

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-754h-5r27-7x3r

Release Date: 2020-09-25

Fix Resolution: 4.4.13,5.1.5

aws/aws-sdk-php-3.139.1: 3 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - aws/aws-sdk-php-3.139.1

AWS SDK for PHP - Use Amazon Web Services in your PHP project

Library home page: https://api.github.com/repos/aws/aws-sdk-php/zipball/31fc7fc73d550e237b34f7c6802250fd4ade9a01

Found in HEAD commit: a98b02cc6219479db20e92032a8c3cb68016cfdb

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (aws/aws-sdk-php version) Remediation Possible**
CVE-2022-24775 High 7.5 guzzlehttp/psr7-1.6.1 Transitive N/A* ❌
CVE-2022-23395 Medium 6.1 aws/aws-sdk-php-3.139.1 Direct N/A ❌
CVE-2023-51651 Low 3.3 aws/aws-sdk-php-3.139.1 Direct 3.288.1 ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-24775

Vulnerable Library - guzzlehttp/psr7-1.6.1

PSR-7 HTTP message library

Dependency Hierarchy:

  • aws/aws-sdk-php-3.139.1 (Root Library)
    • ❌ guzzlehttp/psr7-1.6.1 (Vulnerable Library)

Found in HEAD commit: a98b02cc6219479db20e92032a8c3cb68016cfdb

Found in base branch: main

Vulnerability Details

guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are currently no known workarounds.

Publish Date: 2022-03-21

URL: CVE-2022-24775

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-q7rv-6hp3-vh96

Release Date: 2022-03-21

Fix Resolution: 1.8.4,2.1.1

CVE-2022-23395

Vulnerable Library - aws/aws-sdk-php-3.139.1

AWS SDK for PHP - Use Amazon Web Services in your PHP project

Library home page: https://api.github.com/repos/aws/aws-sdk-php/zipball/31fc7fc73d550e237b34f7c6802250fd4ade9a01

Dependency Hierarchy:

  • ❌ aws/aws-sdk-php-3.139.1 (Vulnerable Library)

Found in HEAD commit: a98b02cc6219479db20e92032a8c3cb68016cfdb

Found in base branch: main

Vulnerability Details

jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS).

Publish Date: 2022-03-02

URL: CVE-2022-23395

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

CVE-2023-51651

Vulnerable Library - aws/aws-sdk-php-3.139.1

AWS SDK for PHP - Use Amazon Web Services in your PHP project

Library home page: https://api.github.com/repos/aws/aws-sdk-php/zipball/31fc7fc73d550e237b34f7c6802250fd4ade9a01

Dependency Hierarchy:

  • ❌ aws/aws-sdk-php-3.139.1 (Vulnerable Library)

Found in HEAD commit: a98b02cc6219479db20e92032a8c3cb68016cfdb

Found in base branch: main

Vulnerability Details

AWS SDK for PHP is the Amazon Web Services software development kit for PHP. Within the scope of requests to S3 object keys and/or prefixes containing a Unix double-dot, a URI path traversal is possible. The issue exists in the buildEndpoint method in the RestSerializer component of the AWS SDK for PHP v3 prior to 3.288.1. The buildEndpoint method relies on the Guzzle Psr7 UriResolver utility, which strips dot segments from the request path in accordance with RFC 3986. Under certain conditions, this could lead to an arbitrary object being accessed. This issue has been patched in version 3.288.1.

Publish Date: 2023-12-22

URL: CVE-2023-51651

CVSS 3 Score Details (3.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-51651

Release Date: 2023-12-22

Fix Resolution: 3.288.1

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.